# Disable NAT loopback for guest network **URL:** \ **Category:** Network and Wireless Configuration\ **Created:** [May 26, 2020, 10:57am UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972 "2020-05-26T10:57:15Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![jefdriesen](https://forum.openwrt.org/letter_avatar/jefdriesen/32/5_5575768a8748004e209b776fc1b2916d.png) [@jefdriesen](https://forum.openwrt.org/u/jefdriesen)\ **Post date:** [May 26, 2020, 10:57am UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/1 "2020-05-26T10:57:15Z")
When enabling NAT loopback for a port forward, it seems to be enabled for both the LAN and guest network. Is it possible to restrict this somehow to the just the LAN network? The server for which I'm creating the port forwarding rules, is located in the LAN network. So it's not accessible directly from the guest network (different vlan). Without the NAT loopback, the connection would appear to come from the WAN, and it would work just fine. I could of course disable the NAT loopback entirely, but then I also loose the advantage for the clients in the LAN network. ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 26, 2020, 11:06am UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/2 "2020-05-26T11:06:45Z")
NAT loopback is a bad idea as it is using router resources to allow lan hosts to communicate. You can add an entry in hostnames (fqdn-\>internal server IP) and you won't need it. Other than that the reflection applies only to the prerouting of the lan zone, provided that the port forward is wan-\>lan. So if you have guest interface in the lan zone, there is the culprit. ---
**Author:** ![aboaboit](https://forum.openwrt.org/user_avatar/forum.openwrt.org/aboaboit/32/13813_2.png) [@aboaboit](https://forum.openwrt.org/u/aboaboit)\ **Post date:** [May 26, 2020, 12:32pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/3 "2020-05-26T12:32:38Z")
Sorry for jumping in: why is "NAT loopback" (aka "reflection") the default choice when creating a new rule? ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 26, 2020, 12:41pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/4 "2020-05-26T12:41:20Z")
I suppose it was decided by some developer to make it easier for users who didn't understand why their DDNS is not working from inside the lan. ---
**Author:** ![aboaboit](https://forum.openwrt.org/user_avatar/forum.openwrt.org/aboaboit/32/13813_2.png) [@aboaboit](https://forum.openwrt.org/u/aboaboit)\ **Post date:** [May 26, 2020, 12:46pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/5 "2020-05-26T12:46:14Z")
Not sure why DDNS should fail without that but ok... I had it enabled only for port forwardings from wan to lan (ssh and anydesk) so I can just turn it off, I guess. Thanks. ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 26, 2020, 12:57pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/6 "2020-05-26T12:57:27Z")
Because without it OpenWrt would drop the packets from LAN towards the public IP of the wan, resolved by the DDNS and we would have tons of posts asking why the port forward is not working. ---
**Author:** ![aboaboit](https://forum.openwrt.org/user_avatar/forum.openwrt.org/aboaboit/32/13813_2.png) [@aboaboit](https://forum.openwrt.org/u/aboaboit)\ **Post date:** [May 26, 2020, 1:14pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/7 "2020-05-26T13:14:42Z")
Understood. I'm using different names for the wan and the lan, that's why I never noticed it. ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 26, 2020, 1:20pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/8 "2020-05-26T13:20:26Z")
This works fine too, others are using the internet name from inside the lan and that causes the issues. ---
**Author:** ![jefdriesen](https://forum.openwrt.org/letter_avatar/jefdriesen/32/5_5575768a8748004e209b776fc1b2916d.png) [@jefdriesen](https://forum.openwrt.org/u/jefdriesen)\ **Post date:** [May 28, 2020, 6:38am UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/9 "2020-05-28T06:38:34Z")
I want to be able to use the same name such that everything always works, regardless of whether I'm using a mobile device (phone or laptop) from inside the LAN or remotely. ---
**Author:** ![jefdriesen](https://forum.openwrt.org/letter_avatar/jefdriesen/32/5_5575768a8748004e209b776fc1b2916d.png) [@jefdriesen](https://forum.openwrt.org/u/jefdriesen)\ **Post date:** [May 28, 2020, 6:56am UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/10 "2020-05-28T06:56:44Z")
> [@trendy](#): > > NAT loopback is a bad idea as it is using router resources to allow lan hosts to communicate. You can add an entry in hostnames (fqdn-\>internal server IP) and you won't need it. Okay, so this results in a DNS request returning the LAN IP address, and going directly to the destination. This seems like a nice alternative, provided that all port forwards are towards the same IP address, and the internal and external port are the same. But I don't think it will fix the problem of the guest network. Both the lan and guest network use the same DNS server. Thus on the guest network, a DNS request will also return the internal LAN IP address. But the firewall will block access to that IP address. > [@trendy](#): > > Other than that the reflection applies only to the prerouting of the lan zone, provided that the port forward is wan-\>lan. So if you have guest interface in the lan zone, there is the culprit. The guest interface is in a separate guest zone, and not the lan zone. ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 28, 2020, 7:39am UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/11 "2020-05-28T07:39:06Z")
> [@jefdriesen](#): > > But I don't think it will fix the problem of the guest network. Both the lan and guest network use the same DNS server. Thus on the guest network, a DNS request will also return the internal LAN IP address. But the firewall will block access to that IP address. You can create a rule on the firewall to allow that particular flow. ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [May 28, 2020, 4:17pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/12 "2020-05-28T16:17:50Z")
(BTW,the NAT loopback only works on the IP/port in question anyways.) ---
**Author:** ![jefdriesen](https://forum.openwrt.org/letter_avatar/jefdriesen/32/5_5575768a8748004e209b776fc1b2916d.png) [@jefdriesen](https://forum.openwrt.org/u/jefdriesen)\ **Post date:** [June 10, 2020, 12:29pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/13 "2020-06-10T12:29:34Z")
Using a hostname to map the FQDN directly to the internal IP address seems to break the DDNS scripts. When they try to resolve the FQDN with nslookup, they also get the internal IP address instead of the public one. ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [June 10, 2020, 12:50pm UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/14 "2020-06-10T12:50:51Z")
Bummer, looks like you'll have to rely on reflection to make it work all together. However the reflection only works for the specific zone that the port forward points to. So unless the guest interface is part of the lan zone, then enabling the reflection on a port forward from wan to lan it won't work for traffic coming from guest. ---
**Author:** ![jefdriesen](https://forum.openwrt.org/letter_avatar/jefdriesen/32/5_5575768a8748004e209b776fc1b2916d.png) [@jefdriesen](https://forum.openwrt.org/u/jefdriesen)\ **Post date:** [January 8, 2021, 8:33am UTC](https://forum.openwrt.org/t/disable-nat-loopback-for-guest-network/64972/15 "2021-01-08T08:33:20Z")
I found a solution for the DDNS problem! In the ddns configuration there is a `dns_server` option to specify an external dns server to detect the current registered IP address. This allows to bypass the local dns resolver (which returns the local ip address) for this specific purpose only. I simply use the nameserver of my DDNS provider.